I very much agree that the use-case is read only and having this level of permissions configured seems way out of scope. I also agree that this this use-case does behave in a system-to-system context and not a user application context.  Specifically because an independent "service" account should be used for this communication which has nothing to do with the authenticated user. This is definitely not a minor factor, for my company at least. ... View more